Analyze detection coverage rules

Analyze security detection coverage by Sigma/Splunk/Elastic across MITRE tactics

Quickly finding detection gaps in ransomware/APT/persistence tactics without token waste.

• · source_type (elastic/splunk/sigma)
• · tactic or threat_profile or technique_id

• · coverage %, top techniques, gaps
• · Navigator JSON layer
• · technique IDs by tactic

• · Sigma/Splunk/Elastic detection rules
• · MITRE ATT&CK framework
• · Navigator

• · Detection rules indexed
• · MITRE tactic mapping complete

• · Large response burns tokens
• · Threat profile incomplete
• · Navigator JSON invalid

• · Token comparison (50KB → 2KB)
• · 6 threat profiles predefined
• · analyze_coverage() returns ~2KB